{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1ae828be-4a08-5781-8bc9-9fccfb1f95e7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7ed062c7-468f-577e-a861-a1d74ca30f3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6e2b61ce-a0c7-5f4e-b3a1-e331d73782c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2b3fb4a6-0c90-5865-87d3-f34f1cbb2bd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8a93cb06-4e3b-5527-81e0-001577bfa736", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b0510f5a-8268-5619-b7ca-d798cdf5cf9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:aab3ce53-306a-5eb5-b777-67d7bea883f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d8b378cc-c06d-50c9-aca0-ff639d935764", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b5a13bed-8045-5100-b7d6-f1a6bdaecfa2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5f268859-ab7c-5221-b543-0395d54d476e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b4e47cd7-e3c6-5ae5-b954-56aca6890547", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-tx. not_affected \u2014 Spring Framework v6.0.12 is not affected by CVE-2018-1257. The vulnerability affected versions prior to 4.3.17 and 5.0.6, which lacked the ability to disable the SpEL-based selector feature in STOMP messaging. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac, April 2018 by Rossen Stoyanchev) added a null check and the ability to set selectorHeaderName to null to disable selector parsing...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4b4e6571-09b0-5528-bf2d-7fcc08859fa6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2bd86c82-3ba3-521e-9228-1ef4aa131b52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1a6e67bb-1e15-5e63-aeef-5947ae7683b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:56402653-57d9-547a-b3c8-b62b0d51cb22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d360b67a-d646-5669-862d-b401e2e1321e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:bc6aa170-5c4d-55b7-a6ba-d0652c2eaa36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:01331948-9d02-5b2a-9033-5bf035775ea3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-tx. Spring Framework 6.0.12 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fc4b1d53-d428-5c0f-b77f-bee5dbfea64b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-tx. not_affected \u2014 CVE-2022-22970 affects Spring Framework applications that use data binding with file upload types (MultipartFile/Part), causing DoS through resource exhaustion when introspection repeatedly calls expensive getters like getInputStream(). The fix excludes read-only properties returning AutoCloseable, ClassLoader, and ProtectionDomain types from JavaBean introspection. Target version 6.0.12 is NOT...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0e795010-1e99-5f56-a6e3-e5e47cbdd94a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b5a08e2e-b84c-596c-b4ec-1433e6535e0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fac4b99f-1cf8-583e-a80b-741dc472cda0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:49c60f51-ff7d-5e5b-bf4a-03ebd1f6d594", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ] }